Evidence Report · Software Valuation

BKFK Admin

Full-stack operations platform for a boxing gym — member management, Square subscription oversight, an AI-assisted call queue & outreach dialer, retention pipeline, bulk SMS/email campaigns, RFID kiosk integration, and business intelligence. Deployed live at admin.bkfk.ca (Node.js, MySQL).

$205K – $412K Traditional build cost
·
2.3 person-years Engineering effort
·
Built in ~4.5 weeks Calendar span (May 28 – Jun 30, 2026)

The Defensible Quartet

Traditional Build Cost

$205K – $412K

Low: $204,750  ·  Mid: $308,250  ·  High: $411,750
What a normal web-software shop charges to plan, architect, and build an operations platform of this scope.

Engineering Effort

2.3 person-years

Mid estimate, two independent models in agreement (productivity model + COCOMO II post-architecture). Represents the human capital compressed into a 4.5-week sprint.

Team & Schedule Replaced

~3 × 9 mo

~3 engineers working for 9 months — the conventional staffing to produce this output on a normal delivery schedule.

Build Speed

~8.0× faster

Shipped in ~4.5 calendar weeks vs the 9-month conventional schedule. 124 commits across 26 distinct edit-days — evidence of sustained, real work.

The Hard Evidence — no estimates, counts straight from git and the codebase

Source: git log, cloc, project console DB — reproducible on demand.
Code (LOC, non-blank, non-comment) 9,895
↳ HTML (templates & admin views) 23,873
↳ JavaScript (server + client) 8,529
↳ SQL (schema & queries) 1,249
↳ Python (scripts & tools) 886
↳ JSON / config 2,094
↳ Docs / specs 157
Files 46
Git commits 129
Distinct edit-days 27
Lines inserted / deleted 379,001 ins  /  348,490 del
Real calendar span 2026-05-28 → 2026-07-02  (~4.5 weeks)
Contributors 5

What's Actually in It — feature enumeration from the source

Auth & Access Control

  • Password login with JWT session tokens (/api/login)
  • Auth middleware enforcing token presence on every protected route (requireAuth)
  • Owner-only gate for sensitive operations (requireAk — separate middleware tier)
  • Pi/kiosk API key gate for hardware endpoints (requirePiKey)
  • Member impersonation for troubleshooting (/api/clients/:id/impersonate)
  • Full action log — every admin operation timestamped with actor (/api/action-log)
  • Admin user management — create, patch, delete staff logins (/api/users)

Member Management

  • Full member CRUD — create, read, update, delete with autocomplete search (/api/clients)
  • Member status: active, suspended, paused — suspend/unsuspend endpoints
  • Per-member payment history, visit log, and emergency contact records
  • Member notes — free-text field with timestamped patch endpoint
  • QR token generation per member for kiosk check-in (/api/clients/:id/qr-token)
  • No-waiver member list — surfaces members missing signed waivers
  • Password change for member portal accounts
  • Email history viewer — full outbound send log per member (/api/email-history/:uid)
  • Resend welcome email and promo-welcome email actions
  • Operational stats dashboard (/api/clients/stats, /api/stats)

Payments & Subscription Oversight

  • Per-member payment recording, listing, and deletion
  • Global payment entry for cash/manual transactions (/api/payments/global)
  • Till / daily cash reconciliation endpoint (/api/till)
  • Financial summary — revenue totals by period (/api/financials/summary)
  • Income timeline — time-series revenue view (/api/financials/income)
  • CSV financial export (/api/financials/export)
  • Square failed-payment sweep — lists overdue subscriptions with details (/api/square/failed-payments)
  • Payment-reminder builder — preview, test-send, and bulk-send dunning emails (/api/square/payment-reminder/*)
  • Card reminder scheduler — automated card-expiry alert runs (/api/financials/card-reminders)
  • Internal Square sync crons — payment sync, next-payment sync, failed-payment sweep (/api/internal/*)
  • Square corporate-card ledger — import txns, categorise, analytics, AI narrative (/api/square-card/*)

Loyalty, Promos & Bonuses

  • Loyalty code generation per member and bulk issuance (/api/clients/:id/generate-loyalty-code)
  • Loyalty validation endpoint for kiosk / front-desk redemption
  • Loyalty stats and recent-activity feed
  • Loyalty email trigger — personalised reward send per member
  • Founders bonus tracking — count cap and per-member grant/revoke (/api/founders-bonus)
  • Per-member bonus CRUD — custom bonus items (/api/clients/:id/bonuses)
  • Promo prospect pipeline — add leads to promotional funnel (/api/promo-prospects)
  • Promo settings — single-source configurable active promo (/api/settings/promo)

Scheduling & Personal Training

  • Coach roster CRUD — add, edit, delete coaches with email management (/api/coaches)
  • Class definition management — create and edit class types (/api/class-definitions)
  • Weekly schedule view — renders all sessions for a given week (/api/schedule/week)
  • Group class sessions — create, edit, delete, and per-session exceptions
  • Personal training sessions — CRUD with exception handling (/api/pt-sessions)
  • Blackout windows — gym-wide closure blocks affecting scheduling (/api/blackout-windows)
  • Coach availability slots — create, update, delete per coach (/api/coaches/:id/availability)
  • PT booking management — review and patch client bookings (/api/pt-bookings)
  • PT booking link settings — configurable public-facing booking URL (/api/settings/pt-links)

Messaging — SMS & Email

  • Outbound message composer with member filter/audience builder (/api/messaging/filter)
  • Immediate SMS/email send with template substitution (/api/messaging/send)
  • SMS message queue — inspect, restart, and clear pending sends (/api/queue)
  • SMS blast engine — audience preview, cost estimate, warmup check, full send (/api/sms-blast/*)
  • Blast pause and resume mid-send (/api/sms-blast/:id/pause, /resume)
  • Real-time blast progress polling (/api/sms-blast/:id/progress)
  • Telnyx inbound webhook — receive member replies, route to conversation threads
  • SMS conversation threads — per-phone history view and admin reply (/api/sms/conversations)
  • Email/SMS blacklist management — add/remove suppression entries (/api/blacklist, /api/sms-blacklist)
  • Spam check endpoint before outbound sends (/api/spam-check)
  • AI newsletter generator — generates content draft from prompt (/api/newsletters/generate)
  • Newsletter lifecycle — draft, approve, send with progress stream (/api/newsletters)
  • Message templates — CRUD for reusable SMS/email bodies (/api/templates)
  • Email blast to all members — QR bulk email, pause-notice email, opening-event blast

Outreach Dialer & Call Queue

  • Outreach user roster — staff callers assigned to the queue (/api/outreach/users)
  • Outreach call log — full history of calls made with outcomes (/api/outreach/calls)
  • Outreach stats — aggregate metrics for the calling campaign (/api/outreach/stats)
  • Caller performance breakdown — per-rep conversion and call counts (/api/outreach/caller-performance)
  • Drop-In v2 dialer overview — pipeline counts and stage summaries (/api/di2/overview)
  • Drop-In v2 activity feed — chronological call and SMS events (/api/di2/activity)
  • Drop-In v2 call queue — list pending calls with call-outcome recording (/api/di2/calls)
  • Drop-In v2 dialer settings — configurable flow parameters (/api/di2/settings)
  • Drop-In v2 message templates — pre-written scripts for callers (/api/di2/templates)

Retention Pipeline & Drop-Ins

  • Retention dashboard — at-risk member list with engagement signals (/api/retention)
  • AI retention recommendation engine — per-member action suggestions (/api/ai/recommend)
  • Drop-in prospect list — track inbound drop-in leads by status (/api/dropins)
  • Drop-in status updates — move prospects through pipeline stages (/api/dropins/:id/status)
  • Drop-in source attribution — segment prospects by acquisition channel (/api/dropins/by-source)
  • Drop-in passes — generate, list, and mark-used day passes (/api/dropin-passes)
  • Member check lookup — verify active membership status (/api/check-member)

RFID Kiosk & Gym Pi Integration

  • RFID key management — list, program, reprogram, clear, scan, and deactivate keys (/api/rfid/*)
  • RFID USB device connect / status (/api/rfid/connect, /status)
  • Kiosk RFID registration flow — start enrollment from admin panel (/api/kiosk/start-rfid-registration)
  • Gym Pi check-in endpoint — validates member at door hardware (/api/pi/checkin)
  • Pi data & schedule sync — push schedule to door kiosk (/api/pi/data, /schedule)
  • Pi RFID sync and registration — sync keys to kiosk hardware (/api/pi/rfid_sync, /register_rfid)
  • Pi pending action queue — command queue consumed by kiosk (/api/pi/pending_action)
  • Pi waiver capture — receive signed waivers from kiosk (/api/pi/waiver)

Landing Page Attribution & BI

  • Landing page stats — conversion rates by source and date range (/api/lp/stats)
  • LP conversion log — per-lead conversion events (/api/lp/conversions)
  • LP lead list — all captured leads with contact details (/api/lp/leads)
  • LP source management — add and remove tracked referral sources (/api/lp/sources)
  • Platform stats summary — gym-wide KPIs in a single call (/api/stats)
  • Diagnostics runner — automated health checks across subsystems (/api/diagnostics/run)

Events, Waivers & Documents

  • Fight Night ticket intake — public registration, paid/fulfilled status, notes (/api/kyle-tickets)
  • Fight Night event list and registrations report (/api/fight-night/*)
  • Historical event ticket query (/api/may29-tickets)
  • Newsletter subscriber list (/api/newsletter/subscriptions)
  • Blank waiver generation — PDF-ready waiver output (/api/waiver/blank)
  • Document image viewer — render uploaded document pages (/api/documents/:id/image)
  • PDF member import — upload, process, log, and rollback member data from PDFs (/api/pdfs/*)
  • Member email update flow — public self-service form with verification (/update-email)

How We Costed It — methodology

Model. The same model with the same constants is applied to every project in this portfolio — there are no per-project complexity multipliers and no schedule compression applied. The generator is console/backend/tools/evidence_merge.py.

Low bound. Productivity model — 9,895 lines of production code ÷ 25 finished LOC per developer-day ÷ 21.7 work-days per month = 18.2 person-months (1.5 person-years). The 25 LOC/day figure is the conservative industry baseline for finished, tested, reviewed code (McConnell, Code Complete); it excludes generated scaffolding and build artifacts.

High bound. COCOMO II post-architecture — PM = 2.94 × (9.89 KLOC)1.0997 = 36.6 person-months (3.1 person-years). Applied nominally, with no effort-adjustment multipliers, so the ceiling is not inflated.

Mid (reported). The arithmetic mean of the two models: 27.4 person-months = 2.3 person-years. This is the figure quoted throughout this report.

Rate assumption. $135,000/year fully-loaded blended developer (salary, benefits, overhead) = $11,250 per person-month. Applied uniformly to all three effort bounds: low $205K, mid $308K, high $412K.

Calendar. Git-verified: 2026-05-28 → 2026-07-02 = 1.16 months of real calendar. COCOMO's schedule equation gives the calendar a conventional team would need: TDEV = 3.67 × 27.40.28 = 9.3 months at a sustainable 3.0 engineers. Speed advantage = 9.3 ÷ 1.16 = 8.0×.